OTX Threat: CitrixBleed 2 (CVE-2025-5777) 7 Steps to Dragonforce Ransomware

Between January and June 2026, multiple unrelated organizations experienced nearly identical intrusions following a standardized seven-step attack chain. The attacks exploited CitrixBleed 2 (CVE-2025-5777), a memory-overread vulnerability in NetScaler ADC and Gateway appliances. Attackers sent malformed pre-authentication login requests that leaked NetScaler memory containing valid session tokens, CVEs: CVE-2017-18362, CVE-2023-4966, CVE-2025-5777, CVE-2026-4368